Don't permit `username` to be edited

Core silently discards the value, anyway. Better to be verbose about it
Correct response message
Throw an error if a duplicate slug is provided